Smart coffee maker on home network. Some gets access to it (open scan of network). Get your wifi password. Get into your router. They setup a fake site for Facebook or your bank. Poison the DNS in your router (e.g. point facebook.com -> fakefacebook.com). You login as normal and…. they have your password.